)
)
)
)
This week was a big week for the international mobile financial services industry. We at ClairMail announced our new Mobile Connectivity Architecture (MCA) – a new way of connecting the mobile channel (and thus the consumer) to nearly all core bank systems, setting in motion our ultimate vision of bank customers being able to complete nearly all bank interactions without ever having to leave such a convenient communication method.
Also in the space, PayPal announced a new “bump” style app in which consumers can bump iPhones to immediately transfer funds. Analyst firm Mercatus projected nearly 30 percent of Canadians to be using some form of mobile banking in the next year. And the state of Arkansas started a new smartphone-centric mobile site enabling residents within the state to make several essential payment types to the state through the mobile channel.
So with all this continued momentum, is there anything still concerning potential mBanking customers? While the answer remains “yes,” it certainly doesn’t have to be with the proper controls.
Last week we introduced the first in our series of security posts, overviewing the need for consumer education and listing out the various types of consumer-facing threats so often cited by bank customers as reasons for hesitancy in adopting mobile financial services.
This week we’ll discuss another necessity when developing a fully baked-out mobile banking platform: business controls.
Business Controls
While many vendors tend to view mobile banking as simply an extension of online banking, the reality is that mobile is an entirely new customer-facing channel with unique risks and security challenges. FIs should not assume that risk management controls currently in place for other channels will be automatically sufficient for the mobile channel. Furthermore, as the mobile banking market matures, new industry regulations will undoubtedly emerge, as was the case with the payment card industry.
FIs implementing a mobile banking solution should take a fresh look at their existing risk profile, security policies and procedures and risk mitigation programs to ensure that they are adequate. Specific areas impacted by mobile banking that should be closely re-examined include:
- Ongoing risk analysis to understand and anticipate the rapidly evolving threat landscape. Results should be formally considered in updates to the mobile banking product roadmap on a continual basis.
- Security policies and procedures, both internal and customer-facing, for all phases of the mobile banking offering.
- Fraud identification and tracking programs, comprising applications purchased from a vendor or developed in-house in combination with professional fraud analysts, to warn against possible attacks based on known fraud patterns.
- Investigative and recovery programs to effectively follow-up on attacks should they occur.
- Customer-facing programs, including guaranteed reimbursement in the event of fraud, along with identity theft prevention and resolution assistance services.
Again, the continued (and mistaken) thinking that mobile is simply an extension of online banking is hampering the institution of such business controls across many current mobile banking deployments. With such programs firmly in place and being successfully marketed to potential customers, however, there’s no doubt that mobile could see adoption rise past online banking adoption even sooner than anticipated.
Be sure to tune in for our next post in this series on security covering one of our most essential services, and one that we believe has the potential to drive 100% adoption of mobile financial services amongst FI consumers: Real-Time Notifications.
